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METHOD AND APPARATUS FOR CONNECTING SINGLE MASTER 
DEVICES TO A MULTIMASTER WIRED-AND BUS ENVIRONMENT 

Field of the Invention 
5 This invention relates to busses using a wired-AND protocol and, more 

particularly, to methods and apparatus for connecting devices in a bus system having 
multiple bus masters. 

Background of the Invention 

10 The l 2 C bus system is an electronic bus for carrying commands and data 

between compatible devices connected to the bus. The system was developed and 
marketed by Philips Semiconductor Corporation and is described in detail in the l 2 C 
Specification, revision 2.0, Philips Semiconductor Corporation 1995, which 
specification is hereby incorporated by reference in its entirety. In the l 2 C bus system, 

15 two wires, called a serial data (SDA) line and serial clock (SCL) line, carry information 
between the devices connected to the bus. Both the SDA and SCL lines are bi- 
directional lines, connected to a positive supply voltage via pull-up resistors as shown 
in Figure 1 to form a "wired-AND" configuration. For example, in the bus configuration 
1 00 illustrated in Figure 1 , the SDA line 1 08 and the SCL line 1 1 0 are connected to 

20 the Vdd supply line 102 by pull-up resistors 104 and 106, respectively. Other busses 
which use a similar protocol include the SMBus and Access.bus. Collectively, this 
type of bus system will be termed a "wired-AND" bus system. The remainder of the 
discussion will focus on the l 2 C bus system with the understanding that the discussion 
applies to these other bus systems as well. 

25 When the bus 101 is free, both the SDA line 108 and the SCL line 1 10 are 

pulled to a "HIGH" state by the resistors 104 and 106. The output stages of devices 
connected to the bus must have an open-drain or open-collector in order to form the 
wired-AND configuration. Two devices 1 12 and 1 14 are shown schematically in 
Figure 1. Device 112 has a clock output stage which includes output transistor 1 16 

30 which is connected across the SCL line 1 10 and ground 118. When a signal on the 
gate 1 17 of transistor 116 turns the transistor on, it pulls the SCL line 110 "LOW." 
Clock signals on the SCL line 1 10 can be detected by means of buffer 120 whose 
output forms the "clock in" line 122. 
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Similarly, device 112 has a data output stage which includes output transistor 
124 which is connected across the SDA line 108 and ground 126. When a signal on 
the gate 123 of transistor 124 turns the transistor on, it pulls the SDA line 108 "LOW." 
Data signals on the SDA line 108 can be detected by means of buffer 128 whose 
5 output forms the "data in" line 130. Device 114 also has a clock output transistor 132 
and clock input buffer 134 and a data output transistor 136 and data input buffer 138 
for communication with the SDA and SCL lines, 108 and 110. 

Devices on the bus communicate by periodically pulling the SDA and SCL lines 
108 and 110 LOW producing data and clock pulses on the lines 108 and 110. In 

10 accordance with the l 2 C protocol, the data on the SDA line 108 must be stable when 
the clock line SCL 1 10 is HIGH. Thus, the HIGH or LOW state of the data line 108 
can only change when the clock line 110 is LOW. Two unique situations arise, which 
situations are defined as START and STOP conditions. In particular, a HIGH to LOW 
transition on the SDA line 108 while the SCL line 1 10 is HIGH is defined as a START 

15 condition. A LOW to HIGH transition on the SDA line 108 while the SCL line 1 10 is 
HIGH is defined as a STOP condition. 

Each device 112, 1 14 on the bus 101 has a unique address and can operate as 
either a data transmitter or a data receiver, depending on the function of the device. 
For example, an LCD driver is always a data receiver, whereas a memory can both 

20 receive and transmit data. In addition to being transmitters and receivers, devices can 
also be bus masters or slaves when performing data transfers. A bus master is the 
device that initiates a data transfer on the bus, generates the clock signals required for 
that transfer and terminates that data transfer. During this transfer, any other device 
to which data is sent, or from which data is received, is considered a slave. The bus 

25 master may transmit data to a slave or receive data from a slave. In both cases, the 
clock signals are generated by the bus master. Bus master and slave relationships 
are not permanent and depend on which device initiated the data transfer at a given 
time. 

More than one bus master device can be connected to bus 1 01 . Bus 
30 implementations with exactly one device capable of acting as a master are called 
single-master busses, while those with two or more devices capable of acting as bus 
masters are called multimaster busses. In a single-master bus system, the l 2 C 
protocol is very straightforward, with every transaction consisting of a START 
condition followed by one or more address and data phases, followed by a STOP 

2 
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condition. Thus, the START and STOP conditions frame all activity on the bus and 
hence define the duration during which the bus is busy. 

In a single-master l 2 C bus, the only interesting error scenario that can present 
itself occurs when a slave device responds to an address or data phase with a 
5 negative-acknowledgement (NAK) response. A NAK response is represented as a 
HIGH signal level on the SDA line 108 during the acknowledge bit time, which is 
defined as the ninth clock pulse of any address or data phase. Since the l 2 C bus is a 
wired-AND configuration, a NAK response is equivalent to no response from a slave 
device. In the case of a NAK on an address phase, this may indicate that the slave 

10 device is busy and unable to accept l 2 C transactions at this time, that it is non- 
functional or simply missing. 

Because NAK conditions happen only at well-defined points in a transaction, 
and because the interpretation of a NAK is straightforward, the response is not 
ambiguous. Most often, the bus master software may simply decide to retry a 

15 transaction that receives a NAK. The important observation is that NAK errors do not 
threaten the correct operation of the l 2 C bus itself; they affect only higher level 
protocol that is typically implemented in software. 

Multimaster l 2 C bus implementations are dramatically more complex. The l 2 C 
protocol is essentially a carrier-sense multiple access with collision detection 

20 (CSMA/CD) scheme, which functions like an Ethernet system. However, unlike an 
Ethernet system, the l 2 C protocol lacks the higher layers of communication protocol 
that transform the Ethernet system into a reliable channel. As such, a large burden is 
placed on a multimaster l 2 C device. At every point in an i 2 C transmission, a bus 
master must be able to detect collisions with other bus masters and recover gracefully. 

25 Some of these collision scenarios are particularly troublesome. For example, 

as described in the aforementioned l 2 C Specification, "arbitration" is the mechanism by 
which multiple bus master devices can drive the I 2 C bus simultaneously without 
causing data corruption. The basic arbitration mechanism relies on the open-collector 
nature of the bus; when two or more masters drive an address or data bit on the SDA 

30 line 1 08, a LOW value driven by one or more bus masters will always win out over a 
HIGH value produced by other bus masters. Thus, any bus master attempting to drive 
a HIGH value during a bit time (by not driving the SDA line 108 LOW and allowing the 
pull-up resistor 104 to keep the line HIGH), but sensing a LOW value during the same 
bit time, will recognize that a collision has occurred with another master driving a LOW 
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value and relinquish the bus. However, if multiple bus masters are driving the same 
sequences of bits, then no collision will be detected until the bit sequences differ. 
Thus, it is possible that a bus master will detect a collision between itself and another 
master at some arbitrarily late point in a transaction, or even not at all. 
5 Loss of arbitration is the simplest error type to handle from a protocol 

perspective because it automatically forces the losing bus master off the bus, as 
defined in the aforementioned l 2 C specification. In general, the bus master driving the 
numerically lowest message (address or data) will retain the bus, while those driving 
numerically higher bit sequences, i.e. with more 1's will lose arbitration and be forced 

10 to retry their transactions after the current transaction completes. 

The arbitration mechanism is defined in the l 2 C specification only for bus 
masters that collide while transmitting address and/or data bits. Since the bus 
masters are all in synchrony preceding the detection of the collision, the correct 
handling of the situation is straightforward, and the state of the bus (busy or idle) is 

15 well understood. Specifically, the bus is busy with the winning master(s) proceeding 
with the transaction. However, a collision between two masters where one is driving a 
data bit and the other is driving a START or STOP condition is, by contrast, not well 
defined by the l 2 C specification regarding how it should be handled. 

This latter type of bus collision is more complex than a simple loss of 

20 arbitration. In this collision type, one bus master is transmitting or receiving a "1" bit, 
represented as a HIGH value on the SDA line 108, when another bus master drives 
the SDA line 108 LOW in the middle of the bit. This START or STOP condition is 
"asynchronous" from the perspective of the bus master driving the data bit, because 
START and STOP conditions are allowed by definition only between address and data 

25 bytes, not on arbitrary bit boundaries. The l 2 C specification is unclear as to whether 
the bus master that detected this START/STOP condition should automatically stop 
driving the bus and record a loss of arbitration. Typically, this type of error is detected 
in hardware and reported to software as distinct from a normal loss of arbitration. In 
addition, when detected by a master while receiving bits, this type of error typically 

30 does not cause a master to stop driving the bus. Thus, when the error occurs, 
multiple masters are still driving the bus, but the START or STOP condition has 
abruptly truncated the transaction previously in progress. This error can occur if two 
or more bus masters drive identical transactions for some time, and then one of the 
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masters issues a STOP or repeated START while the other attempts to continue the 
transaction with more data bytes. 

This error can also indicate a much more serious scenario, which is that at least 
one master has become unsynchronized with the state of the bus (idle or busy) and 
5 has performed a transaction on top of one already in progress. This error can occur if 
noise has been introduced on the bus which has caused the SDA line 108 to 
experience a transient in the middle of a bit. Since the l 2 C bus system is an open 
collector bus with relatively weak pull-ups, and since some systems allow l 2 C devices 
to be "hot-plugged" onto the bus, such transients may occur. 

10 The handling of this error is somewhat complex in that a bus master detecting 

this situation might retain ownership of the bus. In this case, the bus master must 
relinquish mastership of the bus either synchronously by driving a STOP condition, or 
by somehow resetting or reinitializing its l 2 C interface. In practice, it is unclear 
whether any bus master will be left driving a transaction. If the previous transaction in 

15 progress was aborted by all bus masters, then it is possible for the bus to become 
"hung", meaning that all bus masters having seen a START most recently (as 
opposed to a STOP), are waiting for someone to drive a STOP before they will 
attempt to reacquire the bus. Recovery from this state involves timeout timers and 
software specific to the l 2 C master's hardware implementation. 

20 The complexity associated with multimaster l 2 C affects both the hardware 

implementation of the bus master itself, as well as the software driver that works in 
conjunction with the hardware to perform well-formed l 2 C transactions. The added 
software complexity of multimaster l 2 C over single-master l 2 C takes the form of 
sophisticated error handling and bus recovery procedures. Furthermore, there are no 

25 published standards similar to the Ethernet system which specify how various protocol 
violations should be handled, or how higher level protocol layers should be used to 
add reliability to an unreliable l 2 C bus. As a result, a multimaster l 2 C bus system is an 
uncertain environment, with the total reliability of the bus only as good as the quality of 
the poorest bus master in the system. In addition, because the l 2 C bus system is 

30 perceived to be "a simple, two-wire serial bus", testing and verification of a bus master 
implementation's multimaster hardware support is frequently not as thorough as 
needed, resulting in latent bugs. In many cases, these bugs cause data corruption 
and have no software workaround. 



5 



WO 02/10933 PCT/US01/23407 

Therefore, there is a need for apparatus that could be used to construct a 
reliable multimaster l 2 C bus system. 



Summary of the Invention 

5 In accordance with one illustrative aspect of the invention, "firewall" apparatus 

is placed between a single bus master device and a multimaster l 2 C bus system. The 
firewall apparatus transforms all multimaster bus errors into simple NAK errors. Thus, 
a master that is isolated from the multimaster bus by the inventive firewall apparatus 
needs only to retry transactions that receive unexpected NAKs. All the complex 

10 multimaster issues, such as collision handling, transaction termination and bus 

recovery, associated with the actual error that occurred on the multimaster bus are 
handled by the firewall apparatus. 

In accordance with one embodiment, when the master device on the single- 
master side of the firewall attempts to launch a transaction at a time when the 

15 multimaster l 2 C bus is busy, the firewall apparatus absorbs the address driven by the 
single bus master and then stalls the transaction until the firewall apparatus is able to 
successfully acquire and drive the address on the multimaster bus. 

In accordance with another embodiment, the firewall apparatus stalls the single 
bus master transaction by controlling the SCL clock line and driving it low. 

20 In accordance with another embodiment, when the master device on the single- 

master side of the firewall initiates a transaction, the firewall apparatus will 
automatically attempt to acquire the multimaster bus a predetermined number of 
times, thereby relieving the master device from attending to collisions and loss of 
arbitration which occur on the multimaster bus. 

25 In accordance with yet another embodiment, the firewall apparatus is 

implemented by a programmed microprocessor which is controlled by a state machine 
program. In this embodiment, a START condition generated by the single bus master 
is detected by connecting the SDA line to an interrupt port on the microprocessor and 
running an interrupt service routine in response to an interrupt to detect that START 

30 condition. 

In still another embodiment, the firewall software dynamically alters the 
operating frequency of the microcontroller depending on whether the microprocessor 
is communicating with the single master bus or the multimaster bus in order to meet 
timing requirements. 
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Brief Description of the Drawings 

The above and further advantages of the invention may be better understood 
by referring to the following description in conjunction with the accompanying drawings 
5 in which: 

Figure 1 is a schematic electrical diagram of the conventional l 2 C bus system 
illustrating the manner of driving information onto the bus system and receiving 
information from the bus system. 

Figure 2 is a block schematic diagram of the inventive firewall apparatus 
10 connected between a single master l 2 C device and a multimaster l 2 C domain. 

Figure 3 is a more detailed block schematic diagram of the inventive firewall 
apparatus implemented with a microcontroller and connected between a single master 
l 2 C device and a multimaster l 2 C domain. 

Figure 4 is a block schematic diagram of a register set within the 
15 microcontroller which register set is accessible by the port-A master. 

Figure 5 is a state diagram illustrating the processing of initial address 
information. 

Figures 6A and 6B are state diagrams illustrating the read and write 
processing, respectively, of data transmitted between the single master deivce and 
20 multimaster domain. 

Figure 7 is a state diagram illustrating the processing of a repeated START 
condition generated by the port-A master. 

Figure 8 is a state diagram illustrating the processing of a general error 
condition. 

25 Figure 9 is a state diagram illustrating interrupt service processing. 

Figures 10A, 10B and 10C are state diagrams illustrating the initial, read and 
write processing, respectively, of data transferred from the port-A master to the 
registers internal to the microcontroller. 

Figure 1 1 is a screen shot showing oscilloscope traces that illustrate the initial 
30 address phase of a transaction driven by the port-A master. 

Figure 12 is a screen shot showing oscilloscope traces that illustrate the 
operation of the firewall apparatus during a repeated start condition driven by the port- 
A master. 
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Figure 13 is a screen shot showing oscilloscope traces that illustrate the 
operation of firewall apparatus when the port-A master attempts to launch a 
transaction at a time when the port-B multimaster l 2 C bus is busy. 

5 Detailed Description 

The invention concerns a "firewall" apparatus and method that buffers l 2 C 
transactions generated by a bus master and retransmits the transactions on a 
multimaster bus segment. The term "firewall" refers to the fact that the inventive 
apparatus is an asymmetric bus bridge. Thus, it operates in a fashion similar to an 

10 Internet firewall that allows transparent access from a corporate intranet to the 

external Internet, while blocking Internet traffic from entering the corporate intranet. 
Similarly, the inventive apparatus possesses two l 2 C ports, hereafter called "port-A" 
and "port-B", and functions to pass l 2 C traffic transparently from port-A to port-B, but 
not vice versa. The term "port-A master" is used to refer to the master device connect 

15 to port-A on the private l 2 C segment. 

The intended use of the firewall apparatus is shown in Figure 2. The firewall 
apparatus 200 sits between a non-multimaster l 2 C controller 202 and the rest of the 
multimaster l 2 C domain 204. The firewall apparatus 200 has two port interfaces: port 
A 208 and port B 214. As a firewall, the port-A interface 208 is slave-only and serves 

20 only to receive transactions from the port-A master 202 via the SCL and SDA lines 
206 and 210. The port-B interface 214 is master-only and is fully multimaster-capable 
and drives the MM_SCL and MM_SDA lines 212 and 216. In the preferred 
embodiment, the firewall apparatus 200 does not allow masters in the multimaster 
domain 204 to target the port-A master 202 as a slave, although in other embodiments 

25 this capability could be easily added. 

In the configuration of Figure 2, the firewall apparatus 200 exists as the only 
slave device on the private l 2 C segment comprising lines SCL and SDA, 206 and 210 
connected between port-A 208 and the device 202. This configuration is necessary 
because, in the preferred embodiment, the firewall apparatus 200 does not perform 

30 any address filtering, such as would typically be done by, for example, an Ethernet 
bridge. Rather, the firewall apparatus will pass any addresses it receives at port-A 
208 to the multimaster bus 212, 216 connected to port-B 214. Because the port-B bus 
212, 216 is master-only, it blocks all activity in the multimaster domain 204 from 
reaching the port-A master 202. However, such address filtering could easily be 
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implemented for applications that require it, using a RAM array internal to the firewall 
controller. 

As such, when attempting to initiate a new transaction, the port-A master 202 
never sees the private A-side l 2 C segment 206, 210 as "busy." Similarly, the inventive 

5 firewall apparatus filters out any protocol violations that may occur on the port-B 
multimaster bus 212, 216, presenting the port-A master 202 with valid l 2 C protocol in 
all cases. In a preferred embodiment, the firewall apparatus 200 translates all types of 
errors on the port-B multimaster bus 212, 216 into NAKs on the port-A bus 206, 210. 
In accordance with the principles of the invention, by turning all multimaster-related l 2 C 

10 errors appearing at port-B 214 into NAK errors appearing at port-A 208, the port-A 
master 202 does not need to detect and handle any of the troublesome multimaster 
l 2 C error scenarios described previously. Therefore, the inventive firewall apparatus 
allows any non-multimaster-capable l 2 C controller to be connected to a multimaster 
bus, and to operate correctly on the multimaster bus without the need for multimaster- 

15 aware hardware or software. 

For example, a common method for constructing an l 2 C controller is to use a 
"bit-bang" driver which stimulates two open-collector General Purpose I/O (GPIO) 
ports for use as an l 2 C controller. In the PC industry, software to do exactly this, via 
the standard bi-directional parallel port, has existed for years. Since this interface has 

20 no hardware l 2 C support for START/STOP detection or arbitration and is driven at 
software speeds, it is generally assumed that such a port could never be made 
multimaster capable. With the present invention, this is now possible. The software 
driver need only know the very basics of single-master l 2 C operation. 

As previously mentioned, the two wires that comprise the l 2 C bus, the SCL and 

25 SDA lines 206 and 21 0, operate with open collector devices. This means that devices 
on the l 2 C bus are able only to either actively drive these busses into a LOW state, or 
else release the busses and allow the pull-up resistors (Figure 1 , 104 and 106) 
connected to these busses to pull them into a HIGH state. Thus, if any device drives a 
LOW signal onto a bus, then the bus will be LOW, and conversely, a bus will only 

30 become HIGH when all devices have released it and allowed the pull-up resistor to 
pull the bus HIGH. 

When applied to the SCL line 206 this behavior can be used as a clock 
synchronization mechanism, which is discussed in the aforementioned l 2 C-Bus 
specification as a means for devices to slow down, or temporarily stall, a transaction in 
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progress. For example, the following is an excerpt from section 8.3 of the l 2 C 
Specification: 

"In addition to being used during the arbitration procedure, the clock 
synchronization mechanism can be used to enable receivers to cope 
5 with fast data transfers, on either a byte level or a bit level. 

On the byte level, a device may be able to receive bytes of data at a fast 
rate, but needs more time to store a received byte or prepare another 
byte to be transmitted. Slaves can then hold the SCL line LOW after 
10 reception and acknowledgement of a byte to force the master into a wait 

state until the slave is ready for the next byte transfer in a type of 
handshake procedure. 

On the bit level, a device such as a microcontroller with or without limited 
15 hardware for the l 2 C-bus, can slow down the bus clock by extending 

each clock LOW period. The speed of any master is thereby adapted to 
the internal operating rate of this device." 

In the inventive apparatus, the clock synchronization mechanism is used by the 

20 software running on the firewall apparatus microcontroller 201 to selectively stall either 
the port-A bus 206, 210 or the port-B bus 212, 216. In this way, the software controls 
the progress of the transaction on both sides of the firewall apparatus 200. It should 
be noted that the port-A master 202 must correctly implement this clock 
synchronization mechanism for it to work correctly with the inventive firewall apparatus 

25 200. Since the mechanism applies equally to single-master and multimaster l 2 C 
systems, this requirement places no additional burden on the port-A master 202 
beyond that associated with simple single-master l 2 C operation. 

In a preferred embodiment, the firewall apparatus is implemented in a 
programmable microcontroller, but other implementations are possible. A 

30 microcontroller, which is suitable for use with the invention, is the device 87LPC764, 
manufactured and sold by Philips Semiconductor Corporation. This controller is 
programmed with firmware, and hence the preferred embodiment is a combined 
hardware and software implementation. In addition to other hardware resources, this 
microcontroller has one multimaster l 2 C interface. Clearly, however, the inventive 

35 apparatus needs two l 2 C interfaces to fulfill its function as a firewall. Thus, the 

microcontroller's built-in l 2 C interface is used for the port-B bus 212, 216 and the port- 
A slave-only interface is implemented using two GPIO pins on the microcontroller and 
a software "bit-bang" driver. 
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Figure 3 shows how a microcontroller 301 is used to connect a non- 
multimaster-capable l 2 C device 302 to a multimaster bus domain 304. In Figure 3, 
elements that correspond to elements in Figure 2 have been given corresponding 
numerals. For example, microcontroller 301 in Figure 3 corresponds to 

5 microcontroller 201 in Figure 2. The description of elements in Figure 2 that 
correspond to elements in Figure 3 is applicable to Figure 3. 

The 87LPC764 controller 301 includes 4 KB of One-Time-Programmable (OTP) 
internal memory that is used as program code space. Thus, the firewall software is 
embedded within the 87LPC764 controller 301. The 87LPC764 controller 301 runs 

10 with a 20MHZ input clock provided by crystal 322 and capacitors 324 and 326, and 
has an internal machine cycle which is 1/6 m of the input clock, or approximately 
3.3MHz. The reason why this machine cycle is of concern for the inventive firewall is 
that the port-A interface 308 is implemented purely via software and two GPIO pins, 
19 and 20. In order to reliably implement such a bit-bang l 2 C slave interface and allow 

15 it to run at the full speed of 1 0OKbits/sec, the software must be able to poll (and act 
upon) the port-A SDA/SCL pins 19 and 20 between 2-3 times during the minimum 4.7 
microsecond SCL HIGH time given in the l 2 C Specification. The requirement of polling 
greater than twice in this interval is to ensure that the SCL/SDA pins are seen 
correctly during the SCL HIGH time even if the polling loop just misses an initial 

20 transition of SCL=LOW to SCL=HIGH, in which case the polling loop must go through 
two iterations before SCL=HIGH will be detected. 

The polling loop used in the inventive firewall software to monitor the port-A 
interface 308 executes every 1 .5 microseconds, which exceeds two iterations in the 
minimum SCL HIGH time of 4.7 microseconds with margin to spare. Thus, the 20MHz 

25 87LPC764 microcontroller 301 has sufficient performance to implement a bit-bang l 2 C 
slave port at 100 Kbits/sec. 

The 87LPC764 microcontroller includes one multimaster-capable l 2 C interface. 
In the present application, this port is reserved for the port-B interface 314, since this 
interface connects to the system's multimaster domain. This l 2 C interface presents 

30 the software running on the 87LPC764 with a 1-bit wide data path onto the l 2 C bus, so 
software must interact with the register interface on a bit-by-bit basis. Although this 
requires more software to drive the l 2 C interface than with byte-oriented l 2 C devices, 
the bit-oriented interface is actually preferred in that it allows software a much finer 
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level of control over the bus 312, 316. This is particularly useful during bus recovery 
procedures after a fatal protocol error that causes the bus to hang. 

One attribute of the internal l 2 C control logic (not shown) of the 87LPC764 
microcontroller 301 which is inconvenient is that the l 2 C baud rate is intimately linked 
5 to the microcontroller machine cycle through a hardware timer (not shown). This timer 
counts machine cycles to control the timing of l 2 C operations on the port-B bus 312, 
316. Unfortunately, the entire l 2 C core in the 87LPC764 microcontroller 301 is 
identical to that from older, slower, 8051 derivatives, namely the 87C751 . This latter 
device had a much slower maximum machine cycle frequency than the 87LPC764. 

10 Therefore, the l 2 C core in the 87LPC764 microcontroller 301 will generate invalid l 2 C 
timing if the core is run faster than around 8 MHz. 

Thus, there are conflicting requirements: (1) The bit-bang port-A interface 308 
requires the microcontroller 301 to run at 20 MHz, and (2), the 87LPC764 l 2 C logic 
requires the microcontroller to run at 8 MHz or less. Fortunately, the 87LPC764 

15 microcontroller 301 provides a software-programmable register (not shown) to alter 
the operating frequency. Using this register, the inventive firewall software 
dynamically alters the operating frequency depending on whether the port-A bus 306, 
310 or the port-B bus 312, 316 is being stimulated. Specifically, the microcontroller 
301 runs at 20 MHz for port-A 308 operations, and is slowed down to 5 MHz for port-B 

20 314 operations. 

In order to reliably detect new START conditions on the port-A interface 308 
while finishing up the end of a previous l 2 C transaction on the port-B interface 314, the 
port-A SDA line 310 is connected to the microcontroller 301 external interrupt input on 
pin 8 via lead 31 1 , in addition to being connected to the appropriate port-A GPIO pin 

25 20. This interrupt is enabled only when the port-A bus 306, 310 is not busy, i.e. 
immediately after a reset, and between STOP and START conditions on the port-A 
bus 306, 310. Thus, the initial START condition of any port-A transaction is detected 
via this interrupt mechanism, while all other port-A activity for the remainder of a 
transaction is detected via polling. 

30 In addition to acting as an l 2 C firewall, the firewall apparatus 301 also acts as a 

slave device to the bus master 302 connected to port-A 308. Like any l 2 C slave 
device, the firewall apparatus will drive the SDA line 310 during read transactions to 
transmit data to the port-A master 302. As such, if the port-A master 302 hangs, 
crashes, or for any reason ceases activity on the port-A interface 308 in the middle of 
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a transaction, the firewall apparatus 301 will, in turn, cease activity on the port-A bus 
306, 310, and on the port-B multimaster bus 312, 316. In order to prevent a sick port- 
A master 302 from hanging the entire multimaster domain 304, the firewall apparatus 
301 utilizes a watchdog timer (not shown) in the microcontroller 301 to detect a hung 

5 port-A transaction. When this happens, after one second of no activity on the port-A 
interface 308 during a port-A transaction, the microcontroller 301 will undergo a 
hardware reset. This reset clears all state information within the microcontroller 301 
and releases both the port-A and port-B interfaces, 308 and 314, respectively. 

This reset operation is particularly important to prevent a potential deadlock on 

10 the port-A interface 308, as follows: if the port-A master 302 crashes or for some other 
reason aborts a port-A read transaction while the firewall apparatus 301 is driving the 
SDA line 310 LOW to the port-A master 302, then the firewall apparatus 301 will 
simply stay in that state, waiting for additional clock pulses on the SCL line 306. If the 
port-A master 302 recovers, it may attempt to restart the transaction, but it will be 

15 unable to launch a START condition on the port-A interface 308 due to the fact that 
the firewall device 301 is holding SDA line\310 LOW, thereby resulting in a deadlock. 
Utilizing the watchdog timer, the firewall device 301 will reset itself after one second, 
allowing the port-A master 302 to restart the transaction normally. In normal 
operation, this never occurs because the port-A master 302 always terminates 

20 transactions via a STOP condition. The watchdog timer is used here only to recover 
from pathologically bad behavior on the part of the port-A master 302. 

In addition to its normal transparent mode of operation, the firewall apparatus 
also incorporates a bank of registers that may be accessed by software running on the 
port-A master 302. These registers are illustrated in Figure 4 and provide information 

25 to the port-A master 302 regarding the firmware revision of the firewall apparatus chip, 
allow the l 2 C addresses used by the firewall apparatus to be changed, and allow the 
firewall apparatus to be reset under software control by the port-A master 302. The 
apparatus also provides access to a 32-byte RAM array 408 that is not used by the 
firewall apparatus, but is made available through this register interface for diagnostic 

30 purposes. One foreseeable use of this 32-byte RAM array 408 would be as an 
address bitmap indicating which l 2 C addresses reside on the port-A interface and 
which are on port-B interface, thereby permitting the firewall apparatus to implement 
address filtering. This would allow the single-master bus 306, 310 to have other slave 
devices in addition to the firewall apparatus. 
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The mechanism provided for accessing the internal register space is similar to 
that used by other l 2 C devices. The firewall apparatus 301 provides an index register 
410 that is used to read and write the internal register array 400. The index register 
410 acts as a pointer through which the contents of the register array 400 may be read 
5 and written. The index register 410 determines which location in the array that is 
accessible. 

The l 2 C addresses used by the firewall apparatus 301 are determined by the 

contents of the BASE register 404, and default to 0x60 and 0x61 , where 0x60 is the 

write-address, and 0x61 is the read address, as per standard l 2 C addressing. The 
10 index register 410 is write-only via address 0x60, while the register array 400 is 

writable at address 0x60 and readable at address 0x61 . Since write operations to 

both the index register 410 and register array 400 must be affected through l 2 C 

address 0x60, the apparatus discriminates between the two based on the following 

rule: data intended for the index register 41 0 must always be the first byte following 
15 the address phase in a write transaction. Subsequent bytes in the same write 

operation will be directed into the register array 400 starting at the offset indicated by 

the index register 41 0. 

In order to facilitate the reading and writing of multiple consecutive bytes within 

the register array 400, the index register 410 automatically increments by one after 
20 every byte transferred to or from the array 400. This is true whether a given l 2 C , 

transaction moves multiple bytes in a single operation, or only a single byte; the index 

register 410 increments in either case. 

Attempts to write the index register 410 with invalid offset values will be 

ignored. Similarly, if while reading or writing multiple bytes in a single transaction the 
25 auto-increment feature of the index register 410 would result in an invalid index, the 

index register 410 will not increment, thus causing subsequent bytes to be read from 

or written to the last location in the register array 400. 

Note that the actual location of the index register 410 within the apparatus may 

be changed by rewriting the BASE register 404 with a new value. This register 404 
30 must be written with the desired address of the index register 410. The apparatus will 

then occupy address "BASE" and "BASE+1" as described above for accessing the 

index register 410, and register array 400. 

The REVISION register 402 appears within the array 400 at offset 0, and 

contains an encoding of the software revision of the firewall apparatus chip. The 
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major revision 416 is given in bits <7:4>, while the minor revision 418 is given in bits 
<3:0>. For example, a hypothetical software revision level of "1 .7" would result in a 
value in he REVISION register 402 of 000101 1 1 b, or 17 hex. 

The BASE register 404, at offset 1 in the register array 400, contains the base 
5 address used by the firewall apparatus for accesses to the register array 400. This 
register 404 defaults to 0x60 at reset, and may be changed, via an ) 2 C transaction 
from the port-A master 302. Note that since register array accesses are not forwarded 
to the port-B multimaster bus 312, 316, address conflicts between the index register 
410 and actual devices on the port-B bus 312, 316 do not occur. Furthermore, as 

10 described below, when the firewall apparatus has entered a so-called "transparent 
mode", all l 2 C address and data bits are passed to the port-B bus 312, 316. Thus, it is 
possible to selectively access the register array 400 and port-B devices even if they 
occupy the same l 2 C addresses. Nonetheless, it is conceptually less confusing if the 
addresses are kept unique. Therefore, for ease of software development, the address 

15 used by the index register pair 410 is programmable via the BASE register 404. In the 
BASE register 404, the base address is programmed in bits <7:0> with bit <0> being 
forced to 0 to ensure that the index register 410 is on an even address. 

The RESET register 406, at offset 2, can be used by the port-A master 302 to 
force a hardware reset of the firewall apparatus. This may be useful either as part of 

20 the port-A master's own l 2 C initialization sequence, or perhaps as part of diagnostic or 
fault recovery code running on the port-A master 302. The only bit of interest in this 
register is bit 7, which, when written with a "1", will force a hardware reset of the 
firewall apparatus following the completion of the current port-A l 2 C transaction. The 
duration of this reset, and the subsequent reinitialization of the apparatus, is 

25 approximately 25 microseconds, so the port-A master 302 must refrain from starting 
any new l 2 C transactions for at least this amount of time after completing the write to 
the RESET register 406. 

However, resetting the firewall apparatus via this mechanism causes that 
apparatus to believe the port-B multimaster bus 312, 316 is "idle", even if a transaction 

30 is in progress from another master. The firewall apparatus will come back into 
synchronization with the actual state of the port-B bus 312, 316 upon detecting the 
next START or STOP condition. However, in order to prevent the apparatus from 
initiating a transaction on top of one already in progress from another master, the port- 
A master 302 should wait, after resetting the firewall apparatus via the RESET register 
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406, for an amount of time equal to the longest possible l 2 C transaction. This time is 
clearly dependent on the implementation of the other masters in the system, so this 
"maximum transaction time" needs to be agreed upon by all masters in the system. 
This is a general l 2 C requirement, and not specific to the inventive firewall apparatus. 
5 Illustratively, 200ms may be used for this waiting time. The RESET register 406 
always returns '00fV when read. 

Starting at offset 0x20, there is a RAM array 408 of 32 bytes that may be 
accessed by the port-A master 302. In the preferred embodiment, this array 408 is 
available as scratchpad memory, and may be used as a diagnostic area for testing the 

10 firewall apparatus. Other embodiments may use this RAM array 408 for internal 
functions, such as an address bitmap used by the firewall to filter addresses coming 
from the port-A master device 302. This enhancement would allow other slave 
devices on the non-multimaster l 2 C bus 306, 310. 

During normal operation, the firewall apparatus acts transparently, passing 

15 address and data bits back and forth between the port-A and port-B l 2 C interfaces, 
308 and 314. In other words, the port-A master 302 is unaware of the presence of the 
firewall apparatus 301 from both a data and protocol perspective. Access to the 
register array 400 internal to the firewall apparatus, on the other hand, follows a- 
different model of operation. The register array 400 accesses are handled in what will 

20 hereafter be referred to as "local mode" operation. In local mode, the port-A master 
302 may use the port-A l 2 C bus 306, 310 to access the internal register array 400. 
The firewall apparatus 301 does not pass any of the I 2 C information associated with 
the local mode access to the port-B interface 314. This is in contrast to the normal 
"transparent mode" of operation in which address and data bits pass transparently 

25 between the port-A and port-B l 2 C interfaces 308 and 314. 

The firewall apparatus 301 chooses between transparent and local modes of 
operation based on the first address it receives following an initial START condition, 
where an initial START condition is defined as a START condition following a bus-idle 
condition. If the first address that is received is to the internal index register 410 

30 defined by the BASE register 404, then the firewall apparatus will enter the local mode 
operation, where it will remain until the current transaction completes with a STOP 
condition, or until the port-A master 302 issues a repeated START with an address 
other than the index register 410 whichever comes first. Normally it is expected that 
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the port-A master 302 will perform local and transparent mode activity via separate l 2 C 
transactions, separately by a STOP condition. 

The firewall apparatus will never switch from transparent mode into local mode 
in the middle of an l 2 C transaction. In other words, if the port-A master 302 wishes to 
5 access the internal register array 400, any current transparent mode activity must be 
terminated normally by the port-A master 302, via a STOP condition, whereupon the 
local mode access may be initiated with a new START condition. 

Since the behavior of the firewall apparatus is determined chiefly by software 
that programs the microcontroller 301, an overview of that software is discussed 

10 below. Since as mentioned above, the clock speed is run at two different clock 

frequencies: 5 MHz for operations to the port-B multimaster bus 312, 316, or 20 MHz 
for operations to the port-A bit-bang bus 306, 310, the firewall software generally 
never allows activity both l 2 C ports 308 and 314, with one exception. In particular, 
selective stalling of the two l 2 C segments 306, 310 and 312, 316 connected to the 

15 apparatus 301 takes advantage of the clock synchronization mechanism, described 
above and allows the firewall software to concern itself with only one port at a time. 

The manner in which the ports 308 and 314 are stalled is for the firewall 
software to wait for the bus master driving the associated SCL pin (pin 19 in the case 
of port A 308 and pin 10 in the case of port B 314) to drive the SCL bus into a LOW 

20 state. In the case of port-A 308, the firewall software then writes a "0" to the SCL line 
306 to jam it in a LOW state until such time as the firewall software wishes to allow the 
transaction to proceed again. In the case of port-B 314, the internal l 2 C hardware in 
the microcontroller 301 will keep the port-B SCL line 312 in a LOW state until the 
hardware is activated via the software. Thus, the firewall software is able to pass 

25 address and/or data bits back and forth between the two segments 306, 310 and 312, 
316, keeping one segment stalled while servicing the other, and changing the clock 
speed to match the port being serviced. 

There is one case where both ports 308 and 314 may be active at the same 
time. At the end of a transaction, the port-A master 302 will drive a STOP condition. 

30 When this happens, the firewall apparatus must transmit the STOP condition on the 
port-B bus 312, 316, while simultaneously being able to handle a new START 
condition on the port-A bus 306, 310. For this reason, the port-A SDA line 310 is 
connected to the microcontroller's external interrupt input (pin 8) via lead 31 1. This 
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interrupt is enabled only after a STOP condition associated with the previous 
transaction is detected on the port-A bus 306, 310. 

The software routine sen/icing the interrupt must make use of the state dispatch 
polling mechanism on port-A 308, and, therefore, the clock speed must be left running 
5 at 20 MHz while the STOP condition is transmitted on the port-B bus 312, 316. This 
would normally cause invalid bus timing on the port-B bus 312, 316 if the 
microcontroller's internal l 2 C hardware were used to generate the STOP condition. 
Instead, the firewall software bit-bangs the STOP condition onto the port-B bus 312, 
316 with the clock running at 20 MHz. If a new START occurs on port-A bus 306, 310 

10 during this interval, the execution time of the interrupt service routine will stretch the 
port-B STOP condition slightly, but this is of no consequence. At all other times during 
a transaction, port-B 314 is driven directly by the microcontroller's internal l 2 C 
controller hardware (not shown) with the clock running at 5 MHz. 

The only interrupt used in the preferred firewall software implementation is for 

15 port-A START detection at the beginning of a transaction. Since a START is signaled 
by SDA line 310 going HIGH to LOW, this signal is connected to a low-true interrupt 
input on the microcontroller 301 (pin 8.) Also, the firewall software enables this 
interrupt only after a previous STOP condition (or after coming out of a reset 
condition), so it is known in advance that the next LOW level on the port-A SDA line 

20 310 will be a START. However, the interrupt service routine verifies that the combined 
SCL/SDA line pair 306, 310 formed a valid START before proceeding. 

The main body of the firewall apparatus software comprises a software state 
machine which runs synchronously to the port-A interface 308. Figure 5 is a state 
diagram that shows the initial address flow. In this diagram, and those that follow, the 

25 ellipses represent states, which are defined as a section of code that jumps through a 
state dispatch mechanism, which is described below, to another state or functional 
block. A functional block, represented in the diagrams with a rectangle, is a section of 
code that does not exit via the state dispatch mechanism, but instead through a simple 
jump. Most arcs that connect the states and functional blocks have a notation of the 

30 form Ox, 10, or 1 1 . This notation indicates the state of the port-A SCL/SDA pins, 
respectively. Therefore, for example, an arc labeled Ox means the software follows 
this arc when SCL is LOW, and SDA is HIGH or LOW. States and functional blocks 
drawn with dashed lines represent destinations that are fully described in other 
figures. 
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The signaling method defined in the l 2 C bus specification is such that both the 
SCL and SDA lines must be watched simultaneously in order to detect START and 
STOP conditions. Therefore, the software that stimulates the bit-bang port-A interface 
308 samples both signals simultaneously when making decisions regarding transitions 
5 of the port-A state machine. In addition, in order for the software to keep up with the 
required 100 Kbit/sec bit rate on the bus, an efficient method of dispatching the port-A 
state machine based on the sampled port-A SCL/SDA data was needed. 

In a preferred embodiment, the state dispatch method chosen uses jump 
tables, with a separate jump table dedicated to each state of the port-A software state 
10 machine. In order to take action on both the SCL and SDA pins simultaneously, the 
software uses the value of SCL and SDA, which are connected to the microcontroller's 
port#0 bits <2:1>, respectively, as a binary offset into the jump table. By loading the 
address of the jump table into the microcontroller "dptr" register, the single instruction 
"jmp @a+dptr" jumps to the correct entry in the jump table that codes for the current 
15 value of SCL and SDA, and thus dispatches to the next state. 

Figure 5 shows the initial address states and program flow. The software starts 
in the power-on reset state 500 and proceeds to the initialization state 502. From the 
initialization state, the software proceeds to the idle block 504 where the state 
machine awaits a START condition from the port-A master 302. When the START is 
20 seen, as indicated by the busy flag being set by the interrupt service routine 
(described below), the code proceeds to the state 506 called init_sclJow. 

The init_scl_low state 506 simply initializes the cnt variable and then dispatches 
to the states, 510 and 512, that accumulate address bits until the entire initial address 
and read/write bit has been received from port-A master 302. After that, control 
25 passes to the xmit iaddr state 51 6. 

In the iaddr zero state 510, an address bit '0' has been received by the state 
machine from the port-A master 302. The value of the address bit is saved in the 
carry flag via a clear carry command, and then the dispatch mechanism is invoked to 
progress to the next state, or wait here in this state if the port-A SCL/SDA signals have 
30 not yet changed. 

The jump table for the iaddr zero state 510 has four possible destination states 
and functional blocks to which control can flow from state 510. The software arrived in 
state 510 because the SCL line went HIGH with the SDA line low, thus indicating a "0 M 
bit, which in this case happens to be an address bit. When dispatching out of this 

19 
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state, if the SCL/SDA line pair still has the value "10", then control remains in state 
510, as evidenced by the jump back to state 510. Similarly, if the SCL/SDA line pair 
signals a transition from "10" to "11", a STOP condition has occurred. Hence, the 
state 510 dispatches to block 514, which handles a STOP condition prior to the 
5 completion of the initial address. 

In the iaddr one state 512, an address bit '1' has been received by the state 
machine from the port-A master 302. The value of the address bit is saved in the 
carry flag via a set carry command, and then the dispatch mechanism is invoked to 
progress to the next state, or wait here in this state if the port-A SCL/SDA signals have 

10 not yet changed. 

The jump table for the iaddr one state 512 has four possible destination states 
and functional blocks to which control can flow from state 512. The software arrived in 
state 512 because the SCL line went HIGH with the SDA line high, thus indicating a 
"1 " bit, which in this case happens to be an address bit. When dispatching out of this 

15 state, if the SCL/SDA line pair still has the value "1 1", then control remains in state 
512, as evidenced by the jump back to state 512. Similarly, if the SCL/SDA line pair 
signals a transition from "11" to "10", a restart condition has occurred. Hence, the 
state 512 dispatches back to state 506, which handles the restart condition. 

The xmit iaddr state 516 is the first place in the code where the multimaster 

20 port-B l 2 C bus is used. After waiting for the bus to become free using the l 2 C 
arbitration mechanism, the initial address is transmitted on the bus and an 
acknowledge pulse (ACK or NAK) is received from the addressed slave. In the event 
that arbitration is lost during the transmission of this initial address, the code in the 
xmit iaddr state 516 will retry a limited number of times to successfully transmit the 

25 address on the bus. This is the only place in the firewall apparatus design where the 
firewall will automatically retry an operation. This initial address is retried here 
because a loss of arbitration during a transaction's initial address phase is considered 
normal correct behavior in a multimaster system. Therefore, in order to avoid unduly 
burdening the port-A master 302 with NAKs, the firewall repeatedly retries the 

30 transmission of the initial address. 

In the xmit iaddr state 516, the software stalls the port-A bus 306, 310 by 
driving the port-A SCL line 306 LOW. Thus, the port-A master 302 is forced to wait 
while the firewall apparatus is communication on the port-B bus 312, 316. This 
method of stalling the port-A bus when the SCL line goes LOW is used in almost all 

20 
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the states where SCL is low coming into the state. This allows software the time it 
requires to complete the work associated with the state, while holding off the port-A 
master 302 until software is ready to proceed to the next state. 

Following, the successful transmission of the initial address, the software 
5 passes the ACK/NAK bit received from the slave device back to the port-A bus 306, 
310, and then proceeds to state 518 in the case a NAK is received or to state 524 in 
the case an ACK is received. From states 518 and 524, the code flow proceeds to the 
pre_dat block 522 which is the data processing phase of the transaction or to the 
restart state 520 in the case when a repeated START is received. 

10 Figures 6A and 6B show the state flow for the data portion of all transparent 

mode transactions. After an address phase completes as indicated in Figure 5, 
control passes to the pre_dat block 522, which simply initializes the bit counter and 
passes control either to the read flow shown in Figure 6A or the write flow shown in 
Figure 6B, respectively. From that point, control flows similarly for reads and writes. 

15 The read and write flows differ slightly to accommodate the differing transmission 
direction of ACK bits; ACK bits are driven from port-A 308 to port-B 314 for reads, and 
the opposite for writes. 

In the read flow illustrated in Figure 6A, unlike the initial address phase, in 
states 602, 604 and 606 data bits are passed between the port-A and port-B l 2 C 

20 busses on a bit-by-bit basis. In particular in the rgetbit state 602, the code decrements 
the cnt variable, obtains a port-B bit and transfers the bit to port_A. The state 602 
then dispatches to either state 604 or state 606 depending on whether the bit was a 
"1" or "0." States 604 and 606 detect whether a STOP or START condition occurs, 
respectively. For example, a transition of the SDA line from LOW to HIGH with the 

25 SCL line HIGH indicates a STOP condition. In this case, state 604 dispatches to the 
stop processing block 616. Alternatively, a transition of the SDA line from HIGH to 
LOW with the SCL line HIGH indicates a START condition. In this case, state 606 
dispatches to the repeated START state 618. 

Operation continues in this manner until the cnt variable reaches zero, at which 

30 point the state 602 dispatches to state 608 in which the code drives the SDA line 310 
HIGH and waits for either an ACK or a NAK from the port-A master 302. In the case 
of an ACK received, the code dispatches to state 610 and then to state 614. If a NAK 
is received the code dispatches to state 612 and state 614. In both states 610 and 
612, the state of the SDA line is stored in the carry bit. Alternatively, if a STOP is 
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received in state 610, the code flow dispatches to processing block 616 to process the 
stop condition. If, in state 612, a START condition is received, the code flow 
dispatches to state 618 to process the repeated START condition as discussed below. 
In step 614, either an ACK or a NAK has been received from the port-A master 
5 302. The received ACK or NAK is then transmitted to the port-B interface 314 for 
transmission to the slave device. If an ACK has been received, the code flow 
dispatches back to state 620 to process additional data bytes. At the end of a read 
transaction, the port-A master 302 will send a NAK to the slave device in response to 
the reception of the last data byte in order to signal to the slave device that it should 

10 stop driving data on the SDA line. When this occurs, the read transaction is complete, 
and the code enters a state w4ss 624 where it simply watches for a START or STOP 
condition. A START condition is received as indicated by a dispatch to state 628 and 
then to state 618 where a repeated START condition is processed (discussed below.) 
Alternatively, if a STOP condition is received, the code dispatches to state 626 and 

15 then to a stop block 616 for processing the stop condition. In state 614 an error in the 
reception of an ACK or NAK signal causes a jump to a common error routine 622 
which is discussed below. 

In the write data processing flow illustrated in Figure 6B, in a similar manner to 
the read processing flow, in states 632, 634 and 636, data bits are passed from the 

20 port-A l 2 C bus to the port-B bus on a bit-by-bit basis. In particular, if a "0" is received 
from the port-A master 302 as indicated by a dispatch through states 632 and 634 to 
state 640, the code stores the received bit in the carry flag, transfers the stored bit to 
port-B and decrements the cnt variable. If a "1" is received from the port-A master 302 
as indicated by a dispatch through states 632 and 636 to state 640, the code stores 

25 the received bit in the carry flag, transfers the stored bit to port-B and decrements the 
cnt variable. A STOP condition generated by the port-A master, as indicated by a 
dispatch through states 632 and 634 reaches processing block 638 which handles the 
STOP condition. Alternatively, a START condition generated by the port-A master, as 
indicated by a dispatch through states 632 and 636 reaches state 642 which handles 

30 the START condition. 

Operation continues in this manner until the cnt variable reaches zero, at which 
point the state 640 dispatches to state 644 in which the code waits for either an ACK 
or a NAK from the slave device on port-B and transfers the ACK/NAK to the port-A 
master. After transferring the ACK or NAK from the port-B slave device to the port-A 

22 
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master 302 the control passes back to processing block 652 to continue the 
transaction as directed by the port-A master 302. Alternatively, START and STOP 
conditions detected by dispatches through states 646 to 650 and 648 to processing 
block 654 are handled by state 650 and processing block 654, respectively. 
5 Unlike the initial START and initial address phase of an l 2 C transaction, the 

firewall apparatus does not buffer address information following a repeated START. 
This follows the general philosophy that the firewall apparatus buffers as little data as 
possible in order to remain as transparent as possible. As mentioned earlier, the 
buffering of the entire initial address is necessary to hide the normal arbitration losses 

10 and retries that may occur before successfully acquiring the port-B multimaster bus. 

The repeated start state flow is shown in Figure 7. This state is entered when 
the dispatch mechanism detects that signals on the SCL/SDA line pair changed from 
"1 1 " to "10". This state flow is very similar to the write data flow illustrated in Figure 
6B, however, after moving 8 address bits and one ACK bit between the two ports, 

15 control joins up with the same state flow as used following an initial address. 

In particular, the code flow starts in state 700. If the SCL/SDA line pair 
becomes "11", a STOP condition has been received and state 700 dispatches to 
processing block 702 to process the STOP condition. 

Otherwise state 700 dispatches to state 704 in which the cnt variable is reset 

20 and a START condition is issued on the port-B interface 314. Data received from the 
port-A master is detected via dispatches through state 708 to 712 in the case of a "1" 
bit and through state 710 to state 712 in the case of a "0" bit. The received bit is 
stored in the carry flag in both of states 708 and 710. An error in either of states 704 
or 712 causes a dispatch to processing block 706 to process the error. 

25 In state 71 2, the stored bit is transferred to port-B and the cnt variable is 

decremented. When the count reaches zero, state 712 dispatches to state 714 where 
an ACK/NAK is received from port-B 314 and transferred to port-A 308. In the case of 
a NAK received, state 714 dispatches to state 716 which is the same as state 518 and 
processing continues from there. In the case of a ACK being received, state 714 

30 dispatches to state 718 which is the same as state 524 and processing continues from 
there. 

Any errors that occur on the port-B multimaster bus after the initial address 
phase cause control to pass to the common error state flow, called abort_w4stop, 
which stands for "abort and wait for a STOP condition". This state flow, shown in 
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Figure 8, does precisely what the name implies; any ongoing port-B transaction is 
aborted in state 800. If the firewall apparatus is still the master of the port-B bus, then 
it relinquishes control of the bus by sending a STOP condition on the bus. The current 
port-A transaction is also aborted by writing the port-A SDA and SCL lines HIGH. 
5 The code flow then dispatches to state 802 state flow that waits for a STOP 

condition. Any repeated STARTs, address bits, or data bits which the port-A master 
302 may read or write are responded to by the firewall apparatus as indicated by a 
dispatch to state 804 by returning a NAK response until the port-A master 302 
terminates the transaction with a STOP condition. 

10 This error flow accomplishes two things. First, it translates any port-B error 

conditions into port-A NAK bits that persist through the current port-A transaction. 
Since the port-B error condition caused the firewall apparatus to lose mastership of 
the multimaster bus, the firewall apparatus is unable to act upon further bytes in the 
current transaction. In addition, by waiting for the port-A master to perform a STOP, 

15 the firewall apparatus software is resynchronized with the port-A master 302. Once 
the STOP condition is detected, as indicated by a dispatch to processing block 806, 
the doreti routine is called, possibly placing the system in an idle condition as v 
indicated by a jump to state 808. 

In addition to the error handling state flow shown in Figure 8, the software has 

20 several timeout timers built into it to prevent pathological protocol violations on either 
port from hanging the firewall apparatus. For example, in a single-master l 2 C bus 
implementation, it is possible to hang the bus if the master initiates a read transaction 
to the slave and then aborts the transfer without following the correct protocol, which, 
in this case, is to respond to the last byte with a NAK and then generate a STOP 

25 condition. If the slave is driving zero's for data, then it will hold the SDA line low while 
it waits for the next SCL rising edge. If the master neglects to send a NAK to the last 
desired byte and thereby fails to inform the slave to stop driving the SDA line, then the 
slave may continue to drive SDA low. This makes it impossible for the master to drive 
a START or STOP condition, and the bus is effectively hung. The only way out of this 

30 scenario is for the master to realize the hung condition and stimulate clock pulses until 
the slave stops driving SDA LOW, which it will do during the ACK clock pulse, at which 
point the master may issue a STOP and restore the bus to usefulness. Unfortunately, 
many l 2 C masters are not sophisticated enough to perform this bus recovery 
procedure. 

24 
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In a preferred embodiment, the firewall apparatus uses a watchdog timer built 
into the microcontroller 301 to detect when the port-A state machine remains in a non- 
idle state for approximately one second, at which point the microcontroller 301 will 
undergo a hardware reset. This reset releases the port-A SCL and SDA lines 306, 
5 310 and allows the port-A master to retry its transaction. It is therefore critical that the 
port-A master never stall its own transactions for more than one second at any given 
state, as doing so would cause the firewall apparatus to reset. 

Port-B 314 errors such as arbitration loss and asynchronous START/STOP 
errors are signaled by the l 2 C interface built into the microcontroller 310 and handled 
10 via the error state flow shown in Figure 8. In addition to these types of errors, the 
software also implements software timeouts while waiting for specific events, such as 
when waiting for SCL rising or falling edges on the port-B l 2 C bus. If one of these 
events times out, then control passes to the error state flow. 

In a preferred embodiment, two timeout values must not be exceeded on the 
1 5 port-B bus 31 2, 31 6 to prevent the firewall apparatus from entering its error flow. 

These are (1) that no port-B slave device shall stall a transaction with the SCL line 312 
being held low for more than 100 milliseconds during any single clock cycle, and (2) 
that no port-B master may perform a transaction that exceeds 200 milliseconds in 
duration. 

20 Failure to meet requirement (1 ) above will cause the firewall apparatus to 

assume that the multimaster bus is hung during a transaction in which it is currently 
master, and to therefore initiate its bus recovery procedure. Failure to meet 
requirement (2) above will cause the firewall apparatus to assume the multimaster bus 
is hung while it is waiting to become master, causing it to stop transaction processing 

25 and to respond with NAKs to all address and data bytes associated with the current 
port-A transaction. 

The interrupt service routine is illustrated in Figure 9. This routine is used 
during the initial address processing to detect a valid START. The interrupt state 900 
is initially entered via a hardware interrupt caused by a LOW level on the external 
30 interrupt pin (irq pin 8 shown in Figure 3) of the microcontroller 301 , which pin is 
connected to the port-A SDA line 310. Since the interrupt is only enabled after a 
STOP condition, the interrupt reliably detects a START condition. 

When a start condition is detected, state 900 dispatches to state 904 where the 
interrupt routine drives the SCL data line 306 LOW and sets a busy flag to indicate the 
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fact to the main initial address processing loop shown in Figure 5. If the interrupted 
software flow was busy completing the previous transaction's STOP condition on the 
port-B bus 312, 316, the port-A master 302 is forced to wait until the firewall apparatus 
catches up. After completing a STOP transaction on the port-B bus 312, 316, control 
5 passes to the main loop in Figure 5 which remains in state 504 waiting for the 

indication from the interrupt service routine that a new transaction has begun on port- 
A308. 

Alternatively, if, in state 900, it appears that the interrupt occurred on a data bit 
rather than a START condition, then the software assumes that synchronization 
10 between the port-A state machine and the port-A master 302 has been lost, and so 
passes control to the error state 902 to force a resynchronization by waiting for a 
STOP condition. 

Figures 10A-10C show the state flow associated with read and write 
transactions driven by the port-A master 302 to the internal register array 400. This 

1 5 state flow begins in state 1 000 and dispatches to state 1 002 when the port-A master 
generates an address that matches the local index register. In state 1002, the firewall 
apparatus sends an ACK to the port-A master and releases the port-A SCL line 306. 
The code dispatches through state 1004 during a HIGH to LOW transition on the SCL 
line 306 signaling a START condition from the port-A master. Processing of the data 

20 sent by the port-A master is carried out starting in processing block 1006 which is 
described in more detail in Figures 10B and 10C, depending on whether the 
transaction is a read or a write. 

In the read flow illustrated in Figure 10B, in states 1008, 1010 and 1012 data 
bits are passed from the registers to the port-A bus on a bit-by-bit basis. In particular, 

25 in the Lrgetbit state 1 008, the code decrements the cnt variable, obtains a bit from the 
appropriate register and transfers the bit to port-A. The state 1008 then dispatches to 
either state 1010 or state 1012 depending on whether the bit was a "1" or "0." 
Operation continues in this manner until the cnt variable reaches zero, at which point 
the state 1008 dispatches to state 1014 in which the code waits for either an ACK or a 

30 NAK from the port-A master 302. 

The case of an ACK received is indicated by a dispatch through state 1016 to 
state 1022. A NAK is indicated by a dispatch through state 1018 to state 1022. 
Alternatively, if a STOP is received in state 1016, the code flow dispatches to 
processing block 1020 to process the stop condition. If, in state 1018, a START 

26 
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condition is received, the code flow dispatches to state 1024 to process the START 
condition. State 1024 is equivalent to state 506 in Figure 5 and processing continues 
from there. 

In processing block 1022, either an ACK or a NAK has been received from the 
5 port-A master 302. The index register 410 is then incremented and preparations are 
made to respond to a NAK received from the port-a master 302. If an ACK has been 
received, the code flow dispatches back to state 1026 to process additional data 
bytes. At the end of a read transaction, the port-A master 302 will send a NAK to the 
firewall apparatus in response to the reception of the last data byte in order to signal to 
10 the firewall apparatus that it should stop driving data on the SDA line. When this 
occurs, the read transaction is complete, and the code enters a state w4ss 1028 
where it simply watches for a START or STOP condition. A START condition is 
received as indicated by a dispatch to state 1 032 and then to state 1024. 
Alternatively, if a STOP condition is received, the code dispatches to state 1030 and 
15 then to a stop block 1 020 for processing the stop cond ition . 

In the write data processing flow illustrated in Figure 10C, in a similar manner to 
the read processing flow, in states 1034, 1036 and 1038, data bits are passed from 
the port-A l 2 C bus to the registers 400 on a bit-by-bit basis. In particular, if a "0" is 
received from the port-A master 302 as indicated by a dispatch through states 1034 
20 and 1 036 to state 1 042, the code stores the received bit in the carry flag, accumulates 
the bits and decrements the cnt variable. If a "1" is received from the port-A master 
302 as indicated by a dispatch through states 1034 and 1038 to state 1042, the code 
stores the received bit in the carry flag, accumulates the stored bits and decrements 
the cnt variable. A STOP condition generated by the port-A master, as indicated by a 
25 dispatch through states 1 034 and 1 036 reaches processing block 1 040 which handles 
the STOP condition. Alternatively, a START condition generated by the port-A 
master, as indicated by a dispatch through states 1034 and 1038 reaches state 1044 
which, as previously described, handles the START condition. 

Operation continues in this manner until the cnt variable reaches zero, at which 
30 point the state 1 042 dispatches to state 1 046 in which an ACK signal is sent to the 
port-A master 302. The accumulated data is then stored in the appropriate register 
and the index register is decremented. If a STOP is not received, the code prepares 
to send additional data by dispatching to processing block 1050 (back to block 1006). 
If a STOP condition is received, the state 1048 dispatches to processing block 1052. 
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As can be seen in this flow, the index register is incremented after every read 
data byte following the ACK/NAK bit, and after every write data byte just prior to 
sending the ACK bit. Thus, successive bytes may be written to or read from the 
register array without the need to update the index register. 
5 The following three figures, 11,12 and 13, show actual oscilloscope traces of 

an implementation of a preferred embodiment in operation. In these diagrams, the 
port-A side of the firewall, shown as the bottom two traces, is connected to a port-A 
master 302. The port-B side, shown in the top two traces, is connected to the 
multimaster l 2 C segment that contains two other masters in the system. 

10 Figure 1 1 shows the initial address phase of a transaction driven by the port-A 

master 302. In this case, the address driven by port-A master is 20 hex. Prior to the 
first low-going edge on the SDA line 310, the firewall apparatus state machine remains 
in the idle state 504 (Figure 5), waiting for the busy flag to be set. When the SDA line 
306 initially goes LOW, an interrupt is generated at the microcontroller 301 as 

15 previously described. This interrupt causes control to pass to the interrupt service 
routine flow shown in Figure 9. After the port-A master 302 drives the SCL line 306 
LOW, the interrupt service routine stalls the transaction by holding SCL line 306 LOW, 
sets the busy flag, and returns control to the idle state 504. The initial address flow of 
Figure 5 then proceeds to consume all seven address bits and the read/write bit 

20 before stalling the port-A bus 306, 310. 

Next, the firewall apparatus acquires the port-B multimaster bus and re-drives 
the address on the SDA and SCL lines 312, 316. After ninth clock pulse on the port-B 
bus, the firewall apparatus passes the NAK bit received on the port-B bus 314 to the 
port-A bus 308. Note that at this point, the multimaster bus is stalled by the firewall 

25 apparatus, while the port-A bus is running, awaiting the system software to service the 
port-A master to allow the transaction to proceed. 

Figure 12 shows the operation of the firewall apparatus during a repeated start 
condition driven by the port-A master 302. In this example, a transaction driven by the 
port-A master 302 is already in progress and is being passed to the multimaster l 2 C 

30 bus segment 314. At the left of this figure, the port-A master 302 drives a repeated 
START condition to issue a new address during the current transfer. The firewall 
apparatus detects this repeated START and passes control to the flow shown in 
Figure 7. It can be seen in the flow of Figure 7 that the address bits following this 
repeated START condition are passed from port-A 308 to port-B 314 on a bit-by-bit 
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basis. Thus, the latency added to the transaction by the firewall apparatus appears as 
a stretching of the LOW portions of the port-A and port-B SCL lines, 306 and 312. It is 
during these LOW times on the SCL lines 306, 312 that the firewall is servicing the 
other port. 

5 Figure 13 shows the operation of firewall apparatus when the port-A master 

attempts to launch a transaction at a time when the port-B multimaster l 2 C bus is busy. 
This diagram highlights an important aspect of the invention. As can be seen in 
Figure 13, from the signals on the multimaster SDA and SCL lines 312, 316, the port- 
B bus 314 is already busy with a transaction at the time when the port-A master 302 

10 starts a new transaction. In this case, the transaction in progress on the port-B bus is 
a 32-byte read of a slave device (not shown) by one of the port-B masters (not 
shown.) Figure 13 shows how the firewall apparatus absorbs the address driven by 
the port-A master 302, and then stalls the transaction on port-A until it is able to 
successfully acquire and drive the address on the port-B bus 314. 

15 Subsequently, the transaction on port-A is allowed to proceed. Thus, the port-A 

master 302 is liberated from the burdens of handling collisions or tracking the 
busy/idle state of the multimaster bus 314. The port-A master simply launches a new 
transaction, and if the multimaster bus is currently busy, the port-A master 302 is 
stalled until ownership of the multimaster bus has been acquired. 

20 Although an exemplary embodiment of the invention has been disclosed, it will 

be apparent to those skilled in the art that various changes and modifications can be 
made which will achieve some of the advantages of the invention without departing 
from the spirit and scope of the invention. For example, it will be obvious to those 
reasonably skilled in the art that, in other implementation a different microcontroller 

25 may be used. Other aspects, such as the specific state flows, as well as other 
modifications to the inventive concept are intended to be covered by the appended 
claims 

What is claimed is: 
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1 1 . Apparatus for connecting a single bus master device to a multimaster bus l 2 C 

2 environment, comprising 

3 a port-A interface that receives address and data signals from the device 

4 and transmits acknowledgement and negative acknowledgement signals to the 

5 device; 

6 a port-B interface that transmits address and data signals to the 

7 multimaster bus and detects multimaster bus errors in the multimaster bus 

8 environment; and 

9 a controller that transparently passes address and data signals received 

10 on the port-A interface from the device to the port-B interface for transmission 

11 on the multimaster bus and controls the port-A interface to transmit a negative 

12 acknowledgement signal to the device when an error is detected on the 

13 multimaster bus and data and address signals are received from the device. 

1 2. The apparatus according to claim 1 wherein the controller transparently passes 

2 data signals received on the port-B interface from the multimaster bus to the 

3 port-A interface for transmission to the device when no error are detected on 

4 the multimaster bus. 

1 3. The apparatus according to claim 1 wherein the port-B interface comprises a 

2 busy mechanism for detecting when the multimaster bus is busy. 

1 4. The apparatus according to claim 3 further comprising a processing mechanism 

2 operable when the busy mechanism detects that the multimaster bus is busy 

3 for absorbing address signals received from the device and stalling the device 

4 until the multimaster bus is not busy. 

1 5. The apparatus according to claim 4 wherein the device is connected to the port- 

2 A interface by a clock and data line and wherein the processing mechanism 

3 stalls the device by controlling the clock line. 
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6. The apparatus according to claim 1 wherein the controller comprises a state 
machine. 



1 7. The apparatus according to claim 6 wherein the state machine comprises a 

2 programmed microcontroller. 

1 8. The apparatus according to claim 7 wherein the device is connected to the port- 

2 A interface by a clock and data line and the device generates a START signal 

3 by controlling the clock and data line and wherein the START signal is detected 

4 by the microcontroller by generating an interrupt based on a signal on the data 

5 line. 

1 9. The apparatus according to claim 1 further comprising a bus acquisition 

2 mechanism operable when the port-A master initiates a transaction that 

3 automatically attempts to acquire the multimaster bus a predetermined number 

4 of times when the multimaster bus is busy and when arbitration is lost. 

1 10. A method for connecting a single bus master device to a multimaster bus l 2 C 

2 environment, comprising 

3 (a) detecting multimaster bus errors in the multimaster bus environment; 

4 (b) receiving address and data signals from the device and transmitting the 

5 received address and data signals to the multimaster bus when no error 

6 is detected on the multimaster bus; and 

7 (c) transmitting a negative acknowledgement signal to the device when an 

8 error is detected on the multimaster bus and data and address signals 

9 are received from the device. 

1 11. The method according to claim 1 0 further comprising: 

2 (d) transparently transmitting data signals received from the multimaster bus 

3 to the device when no error are detected on the multimaster bus. 

1 1 2. The method according to claim 1 0 further comprising: 

2 (f) detecting when the multimaster bus is busy. 
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1 13. The method according to claim 12 further comprising: 

2 (g) absorbing address signals received from the device when the 

3 multimaster bus is busy; and 

4 (h) stalling the device until the multimaster bus is not busy. 

1 14. The method according to claim 13 wherein the device generates address and 

2 data signals on a clock and data line and wherein step (h) comprises stalling 

3 the device by controlling the clock line. 

1 15. The method according to claim 10 wherein steps (a), (b) and (c) are performed 

2 by a state machine. 

1 16. The method according to claim 15 wherein the state machine comprises a 

2 programmed microcontroller. 

1 17. The method according to claim 16 wherein the device generates a START 

2 signal by controlling a clock and data line and wherein the method further 

3 comprises detecting the START signal by generating an microcontroller 

4 interrupt based on a signal on the data line. 

1 18. The method according to claim 10 further comprising: 

2 (i) in response to the port-A master initiating a transaction, automatically 

3 attempting to acquire the multimaster bus a predetermined number of 

4 times when the multimaster bus is busy and when arbitration is lost. 

1 19. Firewall apparatus for connecting a single bus master device to a multimaster 

2 bus l 2 C environment, comprising 

3 a programmable microcontroller having a software controlled port-A 

4 interface that receives address and data signals from the device and transmits 

5 acknowledgement and negative acknowledgement signals to the device and a 

6 hardware-controlled port-B interface that transmits address and data signals to 

7 the multimaster bus and detects multimaster bus errors in the multimaster bus 

8 environment; and 
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a state machine program running in the microcontroller that transparently 
passes address and data signals received on the port-A interface from the 
device to the port-B interface for transmission on the multimaster bus and 
controls the port-A interface to transmit a negative acknowledgement signal to 
the device when an error is detected on the multimaster bus and data and 
address signals are received from the device. 

20. The firewall apparatus according to claim 1 9 wherein the programmable 
microcontroller has an internal clock which has a clock speed and controls the 
microcontroller and wherein the state machine program controls the internal 
clock speed to have a first speed when address and data signals are received 
on the port-A interface and a second speed when address and data signals are 
received on the port-B interface. 

21 . The firewall apparatus according to claim 19 wherein multimaster bus has a 
busy state and wherein the state machine program detects the multimaster bus 
busy state and absorbs address signals received from the device and stalls the 
device until the multimaster bus is not in the busy state. 

22. The firewall apparatus according to claim 21 wherein the device generates 
address and data signals on a clock and data line and wherein the state 
machine program stalls the device by controlling the clock line. 

23. The firewall apparatus according to claim 19 further comprising bus acquisition 
apparatus operable when the single bus master device initiates a transaction, 
that automatically attempts to acquire the multimaster bus a predetermined 
number of times when the multimaster bus is busy and when arbitration is lost. 
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